GAMBLING AND PRIVACY Siobhan Jenner Office of the Privacy Commissioner NSW Paper presented at the 2 nd National Gambling Regulation Conference, convened by the Australian Institute of Criminology in conjunction with the Australian Institute for Gambling Research and held in Sydney, 6-7 May 1999
Hello my name is Siobhan Jenner and I am the Investigations Officer at Privacy NSW, the Office of the Privacy Commissioner. The Office of the Privacy Commissioner was established by the Privacy and Personal Information Protection Act which was passed in November 1998. The Act has only partly commenced with Mr Chris Puplick being appointed as the Privacy Commissioner. Unfortunately Mr Puplick had a prior commitment today and I have been drafted, or should I say asked to stand in his place this afternoon. As an investigation officer I say without a exaggeration that I am truly unaccustomed to public speaking and I therefore ask you to bear with my outward signs of fear. I will be providing you with a brief overview of the work undertaken by the Privacy Committee and with a summary of the new privacy legislation. I ll also give you an idea of the kinds of gambling related matters the Committee has investigated or provided advice on and which its replacement Privacy NSW is likely to address in future. The Act The Privacy and Personal Information Protection Act requires that NSW government agencies create and implement privacy management plans. These plans will set out how NSW government agencies will deal with personal information. The Act also requires that agencies adhere to information privacy principles when dealing with personal information, subject to certain exemptions. There have been a number of attempts to specify overall standards for the way organisations process personal information, and the information privacy principles have evolved from the OECD 1 principles, which provide a general framework for the transfer of personal data between organisations and jurisdictions. The principles in the new Act are more specific about what steps must be taken in dealing with personal information during and after its collection. In this respect they more closely mirror the information privacy principles contained in the federal Privacy Act. The federal principles were developed by the Australian Law Reform Commission from the OECD principles. The Privacy Committee s 1991 data protection principles were in turn modelled on the federal principles, which while they did not have the force of law, served as the guide and measuring stick for determinations about alleged breaches of information privacy. It is likely that compliance with the information privacy principles contained in the new Act will not be required until after February 2000. It is anticipated that the parts of the Act governing preliminary matters, codes of practice, 1 Organsiation for Economic Cooperation and Development
privacy management plans, the role of the Commissioner, the making of complaints, the review of conduct and the Privacy Advisory Committee will commence in June this year. It is anticipated that the public register provisions will commence in February next year. Complaints Some of you will be familiar with the roles the Privacy Committee has played in providing advice and conducting research, and in investigating privacy related complaints over the course of its 23 years. These roles will continue with the staged commencement of Act. However for the first time, in the case of complaints, the Commissioner will be required to distinguish between complaints about the public and the private sector. If the former, the Commissioner must decide whether the conduct complained about concerns a possible breach of the information privacy principles or the breach of another section of the Act. Complaints which do not concern a breach of the privacy principles, or other prohibitions in the Act, may be investigated if the Commissioner determines that they raise privacy related matters. Privacy NSW is currently looking at developing a new standard for determining such matters, but it is likely that in the interim, such determinations will be based on the Privacy Committee s existing data protection principles. The kinds of gambling related complaints dealt with under the Privacy Committee Act have been thankfully few but they do concern substantial privacy issues. They include the alleged disclosure of telephone betting account information, the disclosure of pokermachine winner information and the use of video-surveillance by clubs and casinos. In a complaint relating to telephone betting information it was alleged that the company concerned, had disclosed betting information to a government department without the account-holder s consent. The department admitted that the information had been provided by the company. It transpired that the information had been provided without the account-holder s consent or without a legal requirement to do so. The company acknowledged that the information had been inappropriately disclosed and offered the complainant an apology. The company also advised that it had reinforced its privacy policy with staff and had improved its computer security systems as a result of the complaint. In another matter concerning the same company, a complainant had received an offer by mail from a pay TV company. The letter addressed the complainant as a telephone betting account holder. Naturally the complainant suspected that the telephone betting company had provided information about him and his account to the Pay TV company. Following enquires it was revealed that the telephone betting company had sent account holder names and addresses to a mailing house which had merged this 3
information with information about the Pay TV offer. The account-holder information was destroyed once the information had been merged and the letters had been sent out. The Committee was advised that at no stage did the pay TV company obtain information relating to the telephone betting account holders. As the dust settles around such complaints what emerges is the fact that when individuals take the decision to gamble using technologies like telephone betting, they surrender a little piece of their privacy. This loss isn t limited to telephone betting, but includes situations where individuals enter competitions, use fly buys cards, or register their purchase of lottery or lotto tickets using a player registration card. Even though individuals aren t always made aware that records are kept of such transactions such as those held by NSW Lotteries, sometimes they receive direct mail marketing as a result of a purchase or entry in a competition. Eleven percent of the Committee s written complaints received in 1997/98 concerned direct mail marketing. The source of the personal information provided to mailing houses and marketing companies can often be traced back to organisations which on-sell individuals personal details. Thus with the gain or the hope of a gain on the part of the individual comes the loss of anonymity and the identification and targeting as a potential customer. The Committee has taken the position that such use, re-use or even misuse of personal information should only occur with the consent of the individual to whom the information relates. Some organisations allow participants in competitions to opt out of this use, but the Committee believes that individuals should be asked if they want to opt in. In other words their consent should be actively sought. It is interesting to note that charitable organisations are now required to ask individuals to opt out under the Charitable Fundraising Regulation 1998. The Committee has received other complaints regarding gambling related matters which concern NSW government agencies. Some of these matters remain on foot and it would not be appropriate for me to expound on them at this stage. I can say though, that once the Privacy and Personal Information Protection Act has fully commenced, the Commissioner will investigate gambling related privacy complaints against agencies such as the Department of Gaming & Racing and the Casino Control Authority, or in regards to any other gambling related matter as long as it concerns privacy issues. Any such investigations would be subject to the exemptions granted by the Act or other legislation, or where agencies have created privacy codes. The binding principles in the Act will only apply to public sector agencies, but the Commissioner will have more general jurisdiction in relation to non-public sector agencies. 4
Advice Under the new Act, the Commissioner will also continue the Committee s work in providing advice on privacy matters, including matters which have an impact on gambling. The Committee has provided advice to the Casino Control Authority and to the Star City Casino on matters relating to pre-employment and probity checks on employees and owners of casinos and surveillance operations. In 1997 the Committee was invited by Star City Casino to inspect the casino s surveillance operations, most of which had apparently been set up to settle disputes relating to gaming payments. The Committee s position on video surveillance is that routine video surveillance should only be used in situations where the benefit to the community clearly outweighs individual rights or other competing social interests. The Casino advised the Committee that it had developed a CCTV code based on the Committee s Invisible Eyes report on CCTV, but it declined the suggestion that compliance with the CCTV policy should be audited by an external organisation. The ambit of recent NSW legislation which might have had an impact on the Sydney Casino has been contained by certain exemptions. The Workplace Video Surveillance Act 1998, an Act which restricts the use of video surveillance in the workplace, contains exemptions for video surveillance carried out in a casino in accordance with the Casino Control Act 1992. The Security Industry Regulation 1998 exempts the Director of Casino Surveillance and casino inspectors from having to meet the requirements the Security Industry Act 1998. The Act provides for the regulation of the security industry and the licencing of security personnel. Large sum transactions in casinos have often been used for the purpose of money laundering. Under the Financial Transactions Act a cash dealer who conducts a cash transaction is required to report financial transactions over $10,000 to Austrac. A person who carries on a business of operating a gambling house or casino is a cash dealer for the purposes of the Act In 1988 the Privacy Committee advised the Senate Standing Committee on Legal and Constitutional Affairs about the privacy issues raised by the then Cash Transactions Reports Bill. The Privacy Committee highlighted the gross privacy invasion potential presented by the establishment of the Cash Transaction Reporting Agency under the Act. It was suggested by the Privacy Committee that the passage of federal privacy legislation ought to be a prerequisite to the establishment of the Agency. Fortunately, the parts of the Financial Transactions Act relating to the establishment of the CTRA did not commence until after the passage of the federal Privacy Act, which 5
meant that Austrac was required to comply with the information privacy principles contained in the Privacy Act. Credit transactions always involve the loss of a certain amount of privacy. However, where an individual uses the internet to gamble or to conduct e-commerce there is an expectation that information relating to those transactions, especially credit information will be protected against unauthorised disclosure. It was reported recently (AFR 6/5) that credit card details of over 100 individuals using an English internet games site had been posted on the internet for 2 days. Our freedom to gamble is thus mitigated by the possibility of the loss of privacy. In a recent American survey of Internet User s Attitudes about On-line Privacy conducted by AT&T, 87% of internet users surveyed stated that they had concerns about their personal privacy while on-line. The paradox of preventing privacy violations by introducing on-line gambling regulation is that it will involve further breaches of privacy. This was noted by the Working Party of State and Territory Gaming Regulatory Officials in their draft report on National Regulatory Model for Interactive Home Gambling Products published in May 1997. The Report proposed that on-line gambling legislation contain provisions creating an action against a service providers licence if the service provider failed to maintain the privacy of player information. It suggested that the Federal privacy principles and the OECD guidelines be used as the standard for privacy protection. I acknowledge that the NSW government determined that existing prohibitions against unlicenced forms of gambling are adequate for NSW, and have thus decided not to introduce on-line gaming legislation, but what was not recognised by the Working Party was the effect of regulation on the privacy of the individual. The moves by the federal government to regulate internet content which flow from the Senate Inquiry into internet content regulation and the Broadcasting Amendment (On-line) Bill are likely to involve grand incursions into the privacy of the internet user. One need only look at the adverse public reaction to the recent discovery that Intell had numbered its Pentium III chips, and was thus able to identify the PC users who had purchased them. The outcry related to the fact that each site these PC users visited could be identified. This represented what privacy expert Dr Graham Greenleaf saw as the thick edge of the internet surveillance wedge. Bearing in mind that on-line wagering is currently accessible on the internet, and despite the fact that on-line gambling in NSW which is not conducted through a totalisator service is considered unlawful, one should ask; if regulatory agencies or law enforcement bodies are granted the power to surveill the activities of illegal on-line gambling users, whether such surveillance will involve the identification of users by similar means to that of the 6
Pentium III chip. 2 Or will it involve reporting to Australian law enforcement agencies by law enforcement agencies in other jurisdictions which monitor and track prohibited internet access, as is currently the case with the access by Australian internet users to certain American websites. The Independent Pricing and Regulatory Tribunal Report on Gaming in NSW (Nov 1998) recently looked at possibility of establishing a gaming oversight body, and it reported the views of individuals and organisations concerned about the problems associated with the gaming. I don t doubt there are situations where the club punter, the on-line gambler or the casino addict ought to be prevented from betting themselves, and sometimes their families into poverty. And I don t dispute the need for gambling regulation where the spectre of organised crime looms large. But excessive oversight legislation can sometimes be a form of heavy handed paternalism which not only threatens the individual s expectation of, or right to, privacy, but also threatens to adversely affect the culture. The privacy impact of new gaming legislation should first be assessed upon the individual and upon the culture. You may have noticed that the City of Sydney has dotted the CBD with video surveillance cameras. As I mentioned earlier, the Privacy Committee has taken the view that CCTV systems can only be justified where community benefit outweighs individual rights or other social interests. The freedom of the individual to move and act freely in the city has now been limited by all-seeing eyes, whose gaze is thought by privacy advocates to create an atmosphere of suspicion. If the use of CCTV systems by local councils in public areas is symbolic of an oppressive state rather than a protective state, where is the community benefit in that? Further legislative attempts to regulate gambling should take note of the effect of incursions into privacy by systems like CCTV. But the hope for the gambling regulatory future is that the Privacy and Personal Information Protection Act has now recognised the right of the individual to the protection of their personal information, and to privacy generally, and will therefore provide the starting point for considerations about the privacy of gambling. 2 The Independent Pricing and Regulatory Pricing Tribunal in its report to government on Gaming in NSW said it was unlikely that home users would be licenced, at 2.1.5. 7